NetSight
IP …
high7.8

CVE-2025-38058

In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock ...

Impact

In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock ... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is not busy, but before it has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see that it's safe to quietly undo mnt_count increment and leaves dropping the reference to caller, where it'll be a full-blown mntput(). Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 5.4.294
from 5.5 before 5.10.238
from 5.11 before 5.15.185
from 5.16 before 6.1.141
from 6.2 before 6.6.93
from 6.7 before 6.12.31
DebianDebian Linux
Version 11.0

Weakness classification

CWE-667

References